use https directly to avoid a redirection